diff --git a/lib/galaxy/web/framework/middleware/static.py b/lib/galaxy/web/framework/middleware/static.py
index 100b2336589..b8be61974ad 100644
--- a/lib/galaxy/web/framework/middleware/static.py
+++ b/lib/galaxy/web/framework/middleware/static.py
@@ -40,7 +40,11 @@ class CacheableStaticURLParser(StaticURLParser):
                     directory = host_val
                     break
 
-        full = os.path.join(directory, filename)
+        full = self.normpath(os.path.join(directory, filename))
+        if not full.startswith(directory):
+            # Out of bounds
+            return self.not_found(environ, start_response)
+
         if not os.path.exists(full):
             return self.not_found(environ, start_response)
         if os.path.isdir(full):